Tech debt: define CI for the gonext repository

Came out of an ideation session, not a scoped request.

This repository has no CI — there is no `.github/workflows/` directory, and the only workflow in the tree is `templates/.github/workflows/ci.yml`, which ships to generated projects instead of running here. Everything that guards this codebase (`go build`, `go vet`, `go test -race`, and the `templates/` ↔ `golden/` drift test in `cmd/scaffold/copy_golden_test.go`) only runs when someone remembers to run `make test` locally.

Defining it should settle what runs on a pull request versus on main, and what to do with `cmd/scaffold/init_e2e_test.go`, which is opt-in behind `GONEXT_E2E=1` because it hits the network and installs real dependencies.

Blocks #45.

Start with the existing templates/.github/workflows/ci.yml and the commands run by make test. Read cmd/scaffold/copy_golden_test.go and cmd/scaffold/init_e2e_test.go to understand the checks and the opt-in network dependency. Done means the repository has a defined workflow policy for pull requests and main, including a documented decision for the E2E test.

Written by the indexing model from the issue text.